Virtual Private Networks (i.e., VPNs) provide a secured means for transmitting and receiving data between network nodes even though many users share a corresponding physical network supporting propagation of the data. Privacy is maintained through the use of a tunneling technique, such as generic routing encapsulation (GRE). The data transmitted between such network nodes may or may not be encrypted to protect against eavesdropping and tampering by unauthorized parties. Because the physical network is shared, costs of using resources are generally reduced for each of many users.
A type of VPN is known as a Dynamic Multipoint VPN (DMVPN). DMVPN allows users to better scale large and small Internet Protocol Security (IPSec) VPNs by combining Generic Routing Encapsulation (GRE) tunnels, IPSec encryption, and Next Hop Resolution Protocol (NHRP) to provide users with easy configuration.
Internet Protocol Security (IPSec) VPNs are built as a collection of point-to-point links. The most efficient way to manage larger and larger collections of these point-to-point links is to arrange them into hub-and-spoke networks. All traffic from behind one spoke (i.e., the traffic from networks that must travel through the spoke to get to the hub) to behind another spoke will need to traverse first to the hub and then back out to the other spoke.
Routers define nodes in a network, and data travels between the nodes in a series of so-called “hops” over the network. Since each router is typically connected to multiple other routers, there may be multiple potential paths between given computers. Typically, the routing information is employed in a routing table in each router, which is used to determine a path to a destination computer or network. The router makes a routing decision, using the routing table, to identify the next “hop,” or next router, to send the data to in order for it to ultimately reach the destination computer.
In a DMVPN environment, each spoke has a “permanent” i.e. always-on IPSec tunnel to a hub, but not to the other spokes within the network. Each spoke registers as clients of the NHRP server, which may reside in the hub. The hub maintains an NHRP database of the publicly routable address(es) of each spoke. Each spoke registers its binding of “publicly routable” address and (private) tunnel address when it boots and becomes capable of querying its NHRP database for the publicly routable addresses of the destination (remote) spokes in order to build direct tunnels to the destination spokes, when needed.
When a spoke needs to send a packet to a destination subnet on another (remote) spoke, it queries the NHRP server for publicly routable address of the destination (remote) spoke. The spoke also obtains the ‘next hop’ for that destination spoke from the NHRP server. After the originating spoke learns the peer address of the remote spoke, it can initiate a dynamic IPSec tunnel to the remote spoke. The spoke-to-spoke tunnels are established on-demand whenever there is traffic between the spokes. Thereafter, packets are able to bypass the hub and use the spoke-to-spoke tunnel.